s
Size: a a a
s
s
s
s
s
s
s
BH
IZ
ЕГ
DWORD32 *buffer = (DWORD32 *)pIrp->AssociatedIrp.SystemBuffer;есть такой код
DWORD32 processesPid = *buffer;
PEPROCESS process;
NTSTATUS status = PsLookupProcessByProcessId(processesPid, &process);
if (!NT_SUCCESS(status))
{
return;
}
PULONG ptr = (PULONG)process;
ULONG offset = 0;
for (ULONG i = 0; i < 512; i++)
{
if (ptr[i] == processesPid)
{
offset = (ULONG)&ptr[i + sizeof(INT_PTR)] - (ULONG)process;
break;
}
}
if (!offset)
{
return;
}
PLIST_ENTRY currListEntry = (PLIST_ENTRY)((ULONG)process + offset);
DbgPrint("Current: %#x", process);
DbgPrint("Prev: %#x", currListEntry);
DbgPrint("process: %#x", process);
DbgPrint("offset: %#x", offset);
DbgPrint("blink: %#x", currListEntry->Blink);
C
DWORD32 *buffer = (DWORD32 *)pIrp->AssociatedIrp.SystemBuffer;есть такой код
DWORD32 processesPid = *buffer;
PEPROCESS process;
NTSTATUS status = PsLookupProcessByProcessId(processesPid, &process);
if (!NT_SUCCESS(status))
{
return;
}
PULONG ptr = (PULONG)process;
ULONG offset = 0;
for (ULONG i = 0; i < 512; i++)
{
if (ptr[i] == processesPid)
{
offset = (ULONG)&ptr[i + sizeof(INT_PTR)] - (ULONG)process;
break;
}
}
if (!offset)
{
return;
}
PLIST_ENTRY currListEntry = (PLIST_ENTRY)((ULONG)process + offset);
DbgPrint("Current: %#x", process);
DbgPrint("Prev: %#x", currListEntry);
DbgPrint("process: %#x", process);
DbgPrint("offset: %#x", offset);
DbgPrint("blink: %#x", currListEntry->Blink);
ЕГ
ЕГ
AB
DWORD32 *buffer = (DWORD32 *)pIrp->AssociatedIrp.SystemBuffer;есть такой код
DWORD32 processesPid = *buffer;
PEPROCESS process;
NTSTATUS status = PsLookupProcessByProcessId(processesPid, &process);
if (!NT_SUCCESS(status))
{
return;
}
PULONG ptr = (PULONG)process;
ULONG offset = 0;
for (ULONG i = 0; i < 512; i++)
{
if (ptr[i] == processesPid)
{
offset = (ULONG)&ptr[i + sizeof(INT_PTR)] - (ULONG)process;
break;
}
}
if (!offset)
{
return;
}
PLIST_ENTRY currListEntry = (PLIST_ENTRY)((ULONG)process + offset);
DbgPrint("Current: %#x", process);
DbgPrint("Prev: %#x", currListEntry);
DbgPrint("process: %#x", process);
DbgPrint("offset: %#x", offset);
DbgPrint("blink: %#x", currListEntry->Blink);
ЕГ
DP
DWORD32 *buffer = (DWORD32 *)pIrp->AssociatedIrp.SystemBuffer;есть такой код
DWORD32 processesPid = *buffer;
PEPROCESS process;
NTSTATUS status = PsLookupProcessByProcessId(processesPid, &process);
if (!NT_SUCCESS(status))
{
return;
}
PULONG ptr = (PULONG)process;
ULONG offset = 0;
for (ULONG i = 0; i < 512; i++)
{
if (ptr[i] == processesPid)
{
offset = (ULONG)&ptr[i + sizeof(INT_PTR)] - (ULONG)process;
break;
}
}
if (!offset)
{
return;
}
PLIST_ENTRY currListEntry = (PLIST_ENTRY)((ULONG)process + offset);
DbgPrint("Current: %#x", process);
DbgPrint("Prev: %#x", currListEntry);
DbgPrint("process: %#x", process);
DbgPrint("offset: %#x", offset);
DbgPrint("blink: %#x", currListEntry->Blink);
DP
ЕГ
DP
DP